Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\SysCommander] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\Drivers\cache\svchost.exe'
- 'C:\Drivers\cache\svchost.exe' -install
Executes the following:
- '<SYSTEM32>\attrib.exe' +s +h c:\Drivers
- '<SYSTEM32>\cmd.exe' /c ""C:\Drivers\cache\frts.bat" "
- '<SYSTEM32>\wscript.exe' "c:\Drivers\cache\md.vbs"
Modifies file system :
Creates the following files:
- C:\Drivers\cache\md.vbs
- C:\Drivers\cache\Debug_20130627.log
- C:\Drivers\cache\svchost.exe
- C:\Drivers\cache\Sysconfig.dll
- C:\Drivers\cache\frts.bat
Deletes the following files:
- C:\Drivers\cache\md.vbs
Network activity:
Connects to:
- 'fo###t-fire.net':21
UDP:
- DNS ASK fo###t-fire.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
